splunk/splunk-operator

Splunk Operator: Indexer Cluster Search Head with local Indexing

Opened this issue · 3 comments

mag-mkorn commented

Please select the type of request

Enhancement

Tell us more

Describe the request
I would like to configure a Standalone resource as a Search Head that searches an indexer cluster but does not forward any data to the cluster.

This would allow us to spin up test Search Heads in our CI/CD Pipeline for PRs and verify that the apps are working as intended. Local indexing makes sure that created alerts, internal logs etc. don't mess with the production data.

Proposed changes(optional)
Add an option that works like clusterManagerRef, but only configures the server.conf without adding the forwarding configuration to outputs.conf.

mag-mkorn commented

This would probably add the possibility to search multiple Indexer Clusters as well.

vivekr-splunk commented

@mag-mkorn can you try creating an app, that configures standalone to connect to cluster manager.

mag-mkorn commented

@mag-mkorn can you try creating an app, that configures standalone to connect to cluster manager.

That's our workaround, but having the option available in the operator would be way more flexible.